1. Introduction & Core Privacy Commitment
RankPilot ("we", "our", or "the App") provides an AI Search and Generative Engine Optimization (GEO) platform for Shopify merchants. We are deeply committed to safeguarding merchant privacy and transparency.
Zero Customer PII Policy: RankPilot does not collect, track, store, sell, or process any Personally Identifiable Information (PII) of your end consumers (such as shopper names, physical addresses, credit card numbers, phone numbers, or emails). RankPilot operates solely upon public and merchant-approved product catalog metadata.
2. Information We Collect and Process
To deliver AI SEO and schema markup services, RankPilot accesses the following store-level data via authorized Shopify Admin GraphQL APIs:
- Product Catalog Metadata: Product titles, descriptions, handles, product types, vendor names, tags, prices, and stock availability levels.
- Custom Metafields: Custom structured schemas, specification matrices, and conversational buyer FAQ JSON arrays created by or managed within RankPilot.
- Historical Snapshots: Prior product titles, descriptions, and metafields strictly used to power our 1-Click Rollback Snapshot feature.
- Indexing Logs: URLs, timestamps, and HTTP response codes of real-time search engine submission pings sent to IndexNow (Bing, Yandex, etc.).
- Store Information: Myshopify store domain, public store URL, and active subscription plan tier for billing verification.
3. How We Use Your Data
The collected catalog data is strictly utilized for the following operational purposes:
- Generating AI-driven SEO titles, meta descriptions, high-density technical comparison tables, and conversational buyer FAQs.
- Constructing certified Schema.org JSON-LD structured data for Google AI Overviews and AI search engine grounding.
- Pinging search engine APIs (IndexNow) to accelerate crawl and re-indexing of catalog updates and restocks.
- Providing point-in-time version history snapshots so merchants can easily roll back content edits.
- Monitoring catalog health, inventory transitions, and schema drift prevention via 24/7 Autopilot.
4. Third-Party Sub-Processors
RankPilot partners with industry-leading, enterprise-grade cloud infrastructure providers to provide our service:
- Vercel Inc. (Hosting & Edge Functions): Cloud infrastructure used to run our server application with TLS 1.3 encryption.
- Google Cloud Platform (Gemini AI API): Used solely to generate semantic product optimization recommendations. Prompt data submitted is never used to train public foundational AI models.
- IndexNow (Microsoft Bing & Participating Search Engines): Receives product URLs to notify crawlers of newly published or restocked items.
- Shopify Inc.: Powers app authentication, OAuth token exchange, and subscription billing.
5. Mandatory Shopify GDPR Compliance & Webhook Handling
RankPilot strictly adheres to the European Union General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA):
- Customer Data Request (
customers/data_request): Acknowledged immediately. Because RankPilot stores zero end-customer PII, we certify that no customer data exists within our systems. - Customer Deletion (
customers/redact): Acknowledged immediately. No customer records exist to redact. - Shop Deletion (
shop/redact): Dispatched by Shopify 48 hours following app uninstallation. Upon receipt, RankPilot completely and permanently purges all store configurations, optimization history, revision snapshots, indexing logs, and sessions from our database.
6. Storefront Cookies & Speed Impact
RankPilot does not place any tracking cookies, behavioral beacons, or analytical fingerprinting scripts on your customer storefront. Our Theme App Extension blocks are rendered using 100% server-side liquid templates with native HTML5 <details>/<summary> tags, ensuring zero script execution penalty and zero user tracking.
7. Data Security Measures
All data in transit is encrypted using modern TLS 1.3 cryptography. All webhook communications from Shopify are cryptographically validated against your store's HMAC-SHA256 signature to prevent spoofing or unauthorized payload injection.
8. Merchant Rights & Contact Information
Merchants may request access to, modification of, or complete deletion of their stored catalog snapshots at any time by contacting our privacy officer:
Privacy Officer: RankPilot Data Protection Team
Email: privacy@rankpilot.app
General Support: support@rankpilot.app